BuildWithMatija
  1. Home
  3. Blog
  5. Tools
  7. Remove .env from Git History: Complete 6-Step Guide

Remove .env from Git History: Complete 6-Step Guide

A developer's step-by-step workflow using git filter-repo, backups, force-push and verification to permanently remove…

29th December 2025·Updated on:28th March 2026··
Tools
Remove .env from Git History: Complete 6-Step Guide

📚 Get Practical Development Guides

Join developers getting comprehensive guides, code examples, optimization tips, and time-saving prompts to accelerate their development workflow.

No spam. Unsubscribe anytime.

Related Posts:

  • •Docker Compose env_file: When to Use vs environment Variables
  • •Cloudflare Tunnel + Docker: Expose Containers Without Nginx or Open Ports
  • •Update Docker to Latest Version on Ubuntu
📄View markdown version
7

Frequently Asked Questions

About the author

Matija Žiberna

Matija Žiberna

Full-stack developer, co-founder

AboutResume

Self-taught full-stack developer sharing lessons from building software and startups.

I'm Matija Žiberna, a self-taught full-stack developer and co-founder passionate about building products, writing clean code, and figuring out how to turn ideas into businesses. I write about web development with Next.js, lessons from entrepreneurship, and the journey of learning by doing. My goal is to provide value through code—whether it's through tools, content, or real-world software.

You might be interested in

Docker Compose env_file: When to Use vs environment Variables
Docker Compose env_file: When to Use vs environment Variables

13th May 2025

Cloudflare Tunnel + Docker: Expose Containers Without Nginx or Open Ports
Cloudflare Tunnel + Docker: Expose Containers Without Nginx or Open Ports

8th October 2025

Update Docker to Latest Version on Ubuntu
Update Docker to Latest Version on Ubuntu

16th August 2025

Contents

  • The Problem: git rm Is Not Enough
  • Step 1: Create a Full Backup of the Repository History
  • Step 2: Create a Clean Mirror for History Rewriting
  • Step 3: Remove the File from All Commits Using git filter-repo
  • Step 4: Re Add the Remote and Force Push
  • Step 5: Verify the File Is Truly Gone
  • Check that the file never appears in history
  • Strong verification across all commits
  • Step 6: Clean Up and Prevent Future Mistakes
  • A Note on Staged Changes and git rm --cached
  • Conclusion
On this page:
  • The Problem: git rm Is Not Enough
  • Step 1: Create a Full Backup of the Repository History
  • Step 2: Create a Clean Mirror for History Rewriting
  • Step 3: Remove the File from All Commits Using git filter-repo
  • Step 4: Re Add the Remote and Force Push
Build with Matija logo

Build with Matija

Modern websites, content systems, and AI workflows built for long-term growth.

Services

  • Headless CMS Websites
  • Next.js & Headless CMS Advisory
  • AI Systems & Automation
  • Website & Content Audit

Resources

  • Case Studies
  • How I Work
  • Blog
  • Topics
  • CMS Hub
  • E-commerce Hub
  • B2B Website Strategy
  • Dashboard

Headless CMS

  • Payload CMS Developer
  • CMS Migration
  • Multi-Tenant CMS
  • Payload vs Sanity
  • Payload vs WordPress
  • Payload vs Contentful

Get in Touch

Ready to modernize your stack? Let's talk about what you're building.

Book a discovery callContact me →
© 2026Build with Matija•All rights reserved•Privacy Policy•Terms of Service
BuildWithMatija
Get In Touch

Last week I accidentally committed a .env file to a GitHub repository. If you have ever done this, you know the feeling. Removing the file from the latest commit is easy, but that does not solve the real problem. The file still exists in the repository history and can be recovered by anyone who knows how to look.

This guide walks through the exact process I used to permanently remove a .env file from the entire Git history, safely, with backups, and with proper verification at the end.

By the end, you will know how to do this confidently without guessing or hoping it worked.

The Problem: git rm Is Not Enough

If you run:

bash
git rm --cached scripts/toolkit/.env.toolkit
git commit -m "Remove env file"

You only remove the file from future commits. Every previous commit still contains the file and its contents. If secrets were inside, they are still exposed.

To truly remove a file from history, you must rewrite Git history.

This sounds scary, but done correctly, it is safe and controlled.

Step 1: Create a Full Backup of the Repository History

Before touching history, create a backup that you can restore from if anything goes wrong.

bash
git clone --mirror https://github.com/USERNAME/REPO.git ad-art-backup.git

This creates a bare mirror containing every commit, branch, and tag. You can restore the repository to its original state from this backup at any time.

Do not skip this step.

Step 2: Create a Clean Mirror for History Rewriting

Now create a separate mirror that you will actually modify.

bash
git clone --mirror https://github.com/USERNAME/REPO.git ad-art.git
cd ad-art.git

This mirror has no working files. It only contains Git objects, which makes it ideal for history rewriting.

Step 3: Remove the File from All Commits Using git filter-repo

Install git filter-repo if you do not already have it.

Then run:

bash
git filter-repo --path scripts/toolkit/.env.toolkit --invert-paths

This command rewrites every commit and removes that file wherever it appears.

You will see output indicating that history was rewritten and the repository was repacked. That is expected.

During this process, Git deliberately removes the origin remote to prevent accidental force pushes.

Step 4: Re Add the Remote and Force Push

Add the remote back:

bash
git remote add origin https://github.com/USERNAME/REPO.git

Now push the rewritten history to GitHub:

bash
git push --force --all origin
git push --force --tags origin

This replaces the repository history on GitHub with the cleaned version.

This is the only destructive step, which is why the backup matters.

Step 5: Verify the File Is Truly Gone

Do not rely on search results or assumptions. Verify explicitly.

Check that the file never appears in history

bash
git log --all -- scripts/toolkit/.env.toolkit

This command should return nothing.

Strong verification across all commits

bash
git rev-list --all | while read c; do git ls-tree -r --name-only $c | grep -x "scripts/toolkit/.env.toolkit" && echo FOUND; done

If nothing prints, the file does not exist in any commit.

Be careful not to confuse this with .env.toolkit.example. Example files are safe and should remain.

Step 6: Clean Up and Prevent Future Mistakes

You can now delete the working mirror:

bash
cd ..
rm -rf ad-art.git

In your normal working repository, add the file to .gitignore:

gitignore
scripts/toolkit/.env.toolkit

Commit this change normally.

If the file ever contained secrets, rotate them. History rewriting prevents future access but does not undo past exposure.

A Note on Staged Changes and git rm --cached

If you still see the file in staged changes during cleanup, this is normal. The correct flow is:

bash
git restore --staged scripts/toolkit/.env.toolkit
git rm --cached scripts/toolkit/.env.toolkit
git commit -m "Remove .env.toolkit from git tracking"

This removes the file from tracking while keeping it locally.

Conclusion

Accidentally committing a .env file is common, but fixing it properly requires more than a simple delete. By creating a backup, rewriting history with git filter-repo, force pushing carefully, and verifying the result, you can fully remove sensitive files from a repository.

You now know how to safely remove a file from the entire Git history and confirm that it is truly gone.

Let me know in the comments if you have questions, and subscribe for more practical development guides.

Thanks, Matija